ramnit | b811cf493d1b572ccffeaa8df73e2a71e5cb14a273f2fe4e166ff0e4c0044558

Analysis

max time kernel
90s
max time network
85s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

154da8be0f63b46282c11abb354d7143_JaffaCakes118.dll
Size

340KB
MD5

154da8be0f63b46282c11abb354d7143
SHA1

327ac2d0271fb927299a75c4afe60ff1509d1df4
SHA256

b811cf493d1b572ccffeaa8df73e2a71e5cb14a273f2fe4e166ff0e4c0044558
SHA512

7bdc83d02bbb69e95397ab57022bdc422aca077ab63d674d54d8127e7930d09d9a243db59330d731448838bee55b784a72b4970f2ff244ad140f7a3f9eb86bfd
SSDEEP

3072:eaMzcgvVx/hTODMjZXTXU1p5o9qlnqYnzfIBdzfVKZqzsoq8na1zFzuJz93llvvK:mcgD/xGMFXTXIrfgdTVPsDUJdzu0

Score

10^/10

ramnit banker spyware stealer trojan worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

889vwL3

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 889vwL3
Executes dropped EXE 2 IoCs

Processes:

889vwL3xoiblvpwyxiakfjt.exe

pid process

2256 889vwL3
1528 xoiblvpwyxiakfjt.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4496 4884 WerFault.exe regsvr32.exe
4088 4288 WerFault.exe svchost.exe
872 2604 WerFault.exe svchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	889vwL3

pid	process
2256	889vwL3
1528	xoiblvpwyxiakfjt.exe

pid	pid_target	process	target process
4496	4884	WerFault.exe	regsvr32.exe
4088	4288	WerFault.exe	svchost.exe
872	2604	WerFault.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4965785E-345E-11EF-BCA5-FA71C8F1560D} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425638369"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

660
Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

889vwL3xoiblvpwyxiakfjt.exe

description pid process

Token: SeSecurityPrivilege 2256 889vwL3
Token: SeDebugPrivilege 2256 889vwL3
Token: SeSecurityPrivilege 1528 xoiblvpwyxiakfjt.exe
Token: SeLoadDriverPrivilege 1528 xoiblvpwyxiakfjt.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

IEXPLORE.EXE

pid process

2484 IEXPLORE.EXE
2484 IEXPLORE.EXE

pid	process
660

description	pid	process
Token: SeSecurityPrivilege	2256	889vwL3
Token: SeDebugPrivilege	2256	889vwL3
Token: SeSecurityPrivilege	1528	xoiblvpwyxiakfjt.exe
Token: SeLoadDriverPrivilege	1528	xoiblvpwyxiakfjt.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
4756	IEXPLORE.EXE
4756	IEXPLORE.EXE
4756	IEXPLORE.EXE
4756	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
4932	IEXPLORE.EXE
4932	IEXPLORE.EXE
4932	IEXPLORE.EXE
4932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

regsvr32.exeregsvr32.exe889vwL3iexplore.exeIEXPLORE.EXEiexplore.exe

description	pid	process	target process
PID 2188 wrote to memory of 4884	2188	regsvr32.exe	regsvr32.exe
PID 2188 wrote to memory of 4884	2188	regsvr32.exe	regsvr32.exe
PID 2188 wrote to memory of 4884	2188	regsvr32.exe	regsvr32.exe
PID 4884 wrote to memory of 2256	4884	regsvr32.exe	889vwL3
PID 4884 wrote to memory of 2256	4884	regsvr32.exe	889vwL3
PID 4884 wrote to memory of 2256	4884	regsvr32.exe	889vwL3
PID 2256 wrote to memory of 4288	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 4288	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 4288	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 4288	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 4288	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 4288	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 4288	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 4288	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 4288	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 2576	2256	889vwL3	iexplore.exe
PID 2256 wrote to memory of 2576	2256	889vwL3	iexplore.exe
PID 2256 wrote to memory of 2576	2256	889vwL3	iexplore.exe
PID 2576 wrote to memory of 2484	2576	iexplore.exe	IEXPLORE.EXE
PID 2576 wrote to memory of 2484	2576	iexplore.exe	IEXPLORE.EXE
PID 2484 wrote to memory of 4756	2484	IEXPLORE.EXE	IEXPLORE.EXE
PID 2484 wrote to memory of 4756	2484	IEXPLORE.EXE	IEXPLORE.EXE
PID 2484 wrote to memory of 4756	2484	IEXPLORE.EXE	IEXPLORE.EXE
PID 2256 wrote to memory of 2604	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 2604	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 2604	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 2604	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 2604	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 2604	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 2604	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 2604	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 2604	2256	889vwL3	svchost.exe
PID 2256 wrote to memory of 4064	2256	889vwL3	iexplore.exe
PID 2256 wrote to memory of 4064	2256	889vwL3	iexplore.exe
PID 2256 wrote to memory of 4064	2256	889vwL3	iexplore.exe
PID 4064 wrote to memory of 5068	4064	iexplore.exe	IEXPLORE.EXE
PID 4064 wrote to memory of 5068	4064	iexplore.exe	IEXPLORE.EXE
PID 2484 wrote to memory of 4932	2484	IEXPLORE.EXE	IEXPLORE.EXE
PID 2484 wrote to memory of 4932	2484	IEXPLORE.EXE	IEXPLORE.EXE
PID 2484 wrote to memory of 4932	2484	IEXPLORE.EXE	IEXPLORE.EXE
PID 2256 wrote to memory of 1528	2256	889vwL3	xoiblvpwyxiakfjt.exe
PID 2256 wrote to memory of 1528	2256	889vwL3	xoiblvpwyxiakfjt.exe
PID 2256 wrote to memory of 1528	2256	889vwL3	xoiblvpwyxiakfjt.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\154da8be0f63b46282c11abb354d7143_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\154da8be0f63b46282c11abb354d7143_JaffaCakes118.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4884

C:\Users\Admin\AppData\Local\Temp\889vwL3
"889vwL3"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 208
5⤵
- Program crash
PID:4088

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2576

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:17410 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4756

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:17416 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4932

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 216
5⤵
- Program crash
PID:872

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:4064

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE"
5⤵
- Modifies Internet Explorer settings
PID:5068

C:\Users\Admin\AppData\Local\Temp\xoiblvpwyxiakfjt.exe
"C:\Users\Admin\AppData\Local\Temp\xoiblvpwyxiakfjt.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 660
3⤵
- Program crash
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4884 -ip 4884
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4288 -ip 4288
1⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2604 -ip 2604
1⤵
PID:4136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\889vwL3
Filesize
95KB

MD5
4e05a5ca4bac745470e7b44d61588ea6

SHA1
4ab1df32c49f3d01f76499a6d23b97ac7be9a76f

SHA256
061d78173b58243979f0ac85b323efeeaf781d2c7a6addca8668d116a11a4abe

SHA512
0d10ab9e4de262bc89730ff6ae57a7dd89cc1b9cbe02641c4dc089262eb7db8a88dec6a078eff3b2728c4397c88fb1beadab7a8aa076b1ea3b6db1b9aeb98a8b

Download Submit
memory/1528-33-0x0000000000400000-0x000000000043A028-memory.dmp

Filesize
232KB

Download
memory/1528-39-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1528-38-0x0000000000400000-0x000000000043A028-memory.dmp

Filesize
232KB

Download
memory/1528-35-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2256-16-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2256-32-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2256-9-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/2256-5-0x0000000000400000-0x000000000043A028-memory.dmp

Filesize
232KB

Download
memory/2256-6-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2256-10-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/2256-21-0x0000000077952000-0x0000000077953000-memory.dmp

Filesize
4KB

Download
memory/2256-20-0x0000000000400000-0x000000000043A028-memory.dmp

Filesize
232KB

Download
memory/2256-23-0x0000000000400000-0x000000000043A028-memory.dmp

Filesize
232KB

Download
memory/2256-24-0x0000000077952000-0x0000000077953000-memory.dmp

Filesize
4KB

Download
memory/2256-12-0x0000000000400000-0x000000000043A028-memory.dmp

Filesize
232KB

Download
memory/4288-14-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/4288-13-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/4884-0-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/4884-4-0x000000001000B000-0x000000001000C000-memory.dmp

Filesize
4KB

Download